10 ms·

"Security is our top priority" is meaningless

84 points by jtwaleson 2y ago

wkat4242 2y ago
I think it's even simpler than the article states. For every company, profit is the top priority.
- jtwaleson 2y ago
  Author here. I agree with what I think you mean, but stating it like that is too simplistic in my view. Money is a great way to measure effort and results, and it's top priority in that at the end of the line, without profit there is no company. But without people, products, a mission, and not being hacked too many times, there is also no company.
  - asynchronous 2y ago
    Wanted to say I appreciated the GK Chesterton quote, I think it set up the article well as a balancing act between all things. As the saying goes, we could have perfect security if we lived in the Stone Age.
    - jtwaleson 2y ago
      Thank you. I hadn’t heard that one before but exactly right :)
- danpalmer 2y ago
  While this is correct, it's also not a particularly useful point. A company can't just do profit. Profits aren't a thing that a company can choose (typically), they aren't an input, they're an output. You can't choose your outputs, you can only choose your inputs and aim them towards specific outputs. How do you achieve profits? Well you do things that your customers want, and one of those things might be security. For some companies, the input of investment in security will result in the output of profits. For others it won't, or the two will be less correlated. If security does convert well into profits then it follows that it should be a priority input for the company, because that's how they will achieve profits. This is still a huge generalisation, but perhaps less of one than "profit is the top priority".
  - Xen9 2y ago
    I feel skeptical; except abuse of worst nature; and do not care enough to comment coherently. A future lives around me. Yet what to Dan means a better model, distantly brings to mind the four conveyor belts from: https://archive.org/details/the-age-of-surveillance-capitalism/ https://archive.org/details/the-age-of-surveillance-capitali...
  - GeneralMayhem 2y ago
    There's a big problem of information asymmetry, though. "Security" is a very noisy metric, and not a quality that's easily evaluated by 99.9% of your customers. Outside of specialty domains like national defense (and even then...) customers don't generally care about "secure", they care about "not obviously insecure", and almost all products will appear to be "secure" enough right up until the moment that they're visibly or publicly compromised. If you either stay under the radar or get lucky long enough, you can turn profits for quite a while before the chickens come home to roost.
  - markus23 2y ago
    security (at least as meant in the advertisement) is also output
- switch007 2y ago
  The owners getting rich is the top priority
  - draugadrotten 2y ago
    Indeed, a company is supposed to do what the owner of the company wants. A company does not have morals; owners do.This is why owners matter. You are starting to discover what is called a "business model". For a good introduction, take a look at Osterwalders BMC. https://www.strategyzer.com/business-models-the-toolkit-to-design-a-disruptive-company https://www.strategyzer.com/business-models-the-toolkit-to-d...
jtwaleson 2y ago
The title was edited here by mods (I liked the original, but "BS" is a maybe a bit clickbaity?). Could it be changed to: "Security is our top priority" is meaningless. ?
Springtime 2y ago
> In my ideal world, companies would say "We maintain a state of the art security system [...] it is one of the most important things we work on and we spend a large amount of our effort on it." Tbh as a consumer I'd rather a company not just give self-appraisals of security in the form of overt marketing lines but let pen tests, post-mortem analyses and such speak to their robustness/lessons they've learned. Marketing is virtually always that security is top notch regardless of realities so it's hard not to be skeptical of ordinary spiels. It's like third-party VPN services. It's all well and good to market security but when they get breached/raided/etc and it turns out they don't hold up to the claims then it just increases one's cynicism. At least those like Mullvad from everything I've seen match their statements (no affiliation, nor do I even use it, just useful for this example). Ed Catmull of Pixar once brought up in a talk, referring to cliched lines like "Story is the most important thing" despite various productions' output being mediocre in that regard, that once an important idea can be encapsulated into a concise statement that the statement per se can be used without fear of changing behavior. Could be said for a lot of marketing.
- vaylian 2y ago
  > but let pen tests, post-mortem analyses and such speak to their robustness/lessons they've learned. It depends on which audience you want to reach when you want to advertise how secure your product/service is. Most people outside IT security have no idea what a penetration test is nor can they make sense of jargon-heavy post-mortems.
  - Springtime 2y ago
    They can put such things in a company blog for those who are looking for it, it doesn't have to be on the front page. Google, Cloudflare, the previously mentioned Mullvad, etc take this approach (and they often wind up submitted to the relevant audiences). This strengthens their brand trust in terms of security among key groups.
- JohnFen 2y ago
  I agree entirely. > I'd rather a company not just give self-appraisals of security Companies routinely lie right to your face. No company's self-appraisal about anything is worth paying any attention to.
jsemrau 2y ago
What I commonly see with "top priority" is that it means it's someone else's responsibility. Usually allocated to the CEO.
miika 2y ago
If security is top priority, to me it starts from deciding what kind of data actually needs to be stored. Then the service is designed from that perspective. More sensitive data I need store, more I need to think about security as well (and more expensive it gets). If it's obvious that the service doesn't have much worth of hacking for, it's already better starting point than if I know it's going to be hack attraction.
jjav 2y ago
Here's a true story about one instantiation of "security is our top priority". You be the judge on whether this is an extreme outlier or pretty much the norm. I was at one company where the PM blurted out (paraphrasing, but very close) "Enough of security talk. We will put out some nice wording on our website stating that security is our top priority and our product is perfectly secure. And that's that. We will not spend a single penny beyond that on making it so-called secure." So, that's often what companies mean when they say "security is our top priority". (The referred PM has since had a long career at a fruit-shaped FAANG, presumably making products secure. I hope they have grown up a bit.)
- Dalewyn 2y ago
  Looking at it another way, he put an end to further spending on "security talk" by putting up the security talk of security talks. Art of the Deal indeed.
- lb1lf 2y ago
  On a somewhat related note, I once worked on a vessel which had 'SAFETY FIRST' stencilled onto the superstructure (quite common). Underneath, someone had stencilled in slightly smaller script 'second only to profit' (Somewhat less common, but refreshingly honest. Or cynical. Or both)
  - Dalewyn 2y ago
    Reminds me of this insightful article: https://mikerowe.com/2020/03/walk-me-through-this-safety-third-thing/ https://mikerowe.com/2020/03/walk-me-through-this-safety-thi...
  - WalterBright 2y ago
    Safety is a luxury that profit enables. Increased productivity => increased profits => more safety Nothing comes for free.
    - worble 2y ago
      Or, more likely Increased productivity => increased profits => shareholders see number goes up => number must go more up year on year => everything (including safety) falls to the wayside in the pursuit of more profit
catoc 2y ago
The same as “We care about your privacy”
- doe_eyes 2y ago
  I actually think these are very different. Big tech companies generally care about security because most of the time, it aligns with their self-preservation. They don't want their secret sauce leaked, they don't want internal mails and payroll posted on the internet, they don't want their users hurt. It's not "top priority", but security probably shouldn't be your top priority; if it is, there is only one winning move: don't build anything. That said, security often ranks high, especially if the company had a couple of close calls before. In contrast, preserving privacy is often in direct contrast to business goals. You want to preserve it to some limited extent to maintain user trust and avoid offending the regulators, but there is a constant business pressure to get real close to that line.
  - catoc 2y ago
    I actually think we're saying the same thing. Big tech companies care about profit. That's fine, they're companies. If security - or a pretense thereof - is needed to increase or safeguard profits, only at that point do they start 'caring' about security. With privacy it's even worse. Think Apple cares about privacy? It's just - currently - aligned with their product strategy.
- parasti 2y ago
  I always finish that sentence in my head with something like "we care about your privacy so much that we want to collect all your personally identifiable data and sell it".
konschubert 2y ago
"Safety Third" by Mike Rowe: https://www.youtube.com/watch?v=Km8XxRCuCho https://www.youtube.com/watch?v=Km8XxRCuCho (I don't fully agree with the message though. It's not just the user of the process that is responsible for their safety. It's mostly the designers of the process.)
whatnotests2 2y ago
Under capitalism, anything is lucky to come second, after profit.
Animats 2y ago
The military has a better model of security. They protect things at different security levels. I've spent time in the classified world. Security can be obtained, but costs are high. At the aerospace company, we estimated for bid purposes that running a project at SECRET doubled the cost. Running at levels above that became even more expensive, and much slower. You have to partition things, so that only the really critical stuff gets the most expensive protection. It's common to have a project where the project is mostly unclassified, many things are SECRET, and a very few things are at higher levels. The military views security as time-limited. When and where the attack will start is highly classified until the attack is underway. After that, there is no secret. New weapons systems eventually get used or cancelled, after which they're less secret. The intelligence community wants to protect info forever, though. The credit card services get this. The CVV is required to have a higher level of protection than credit card numbers or names and addresses. Banks understand separation of functions and mutual mistrust. Most computer security work doesn't think this way.
- LilBytes 2y ago
  Interesting that your experience was a double increase in costs from going up in security level. My experience was it was an order of magnitude (10x) at each level . E.g., OFFICIAL let's say is $1,000,000 PRIVATE becomes $10,000,000 SECRET becomes $100,000,000 What we did experience was the cost in time to deliver a service doubled however. E.g., OFFICIAL was 3 years, PRIVATE was 6 years and so on. I expect it varies significantly between types of system, ours was a SaaS platform that read telemetry from embedded systems on assets in the field, so I'd assume that would be one of the drivers for my differing experience than yours.
- WalterBright 2y ago
  > Most computer security work doesn't think this way. The computer industry is determined to relearn the well-known lessons the hard way. For example, we still have a single password breach brings down the entire system. It's like building a battleship that would sink if a 2 inch hole in the hull happened. The way to make systems secure is not to devise a perfect password system. The way is to make the system secure in spite of password breaches. It's a completely different mindset. To return to the battleship analogy, it isn't about preventing holes in the hull. It's about surviving holes in the hull.
cjpearson 2y ago
Instead of Chesterton, I think Thomas Aquinas made the same point more simply: "If the highest aim of a captain were to preserve his ship, he would keep it in port forever."
- jtwaleson 2y ago
  That’s beautiful and succinct. I wasn’t aware of it, thanks for sharing!
- olivierduval 2y ago
  When I started to work at a big company on car safety, my manager told me as a joke: "the safest car is the car that doesn't move".
- Y_Y 2y ago
  > A ship in port is safe. But that’s not what ships were built for. arsa Grace Hopper, who was quoting John Shedd.
- spywaregorilla 2y ago
  What if two other aims, combined, outweighed the desire for safety?
wofo 2y ago
> It takes guts to defend non-extremist positions, because the extremists will always have more powerful one-liners. Thanks for that quote :)
- jtwaleson 2y ago
  It’s a pretty powerful one-liner right? ;)
MattPalmer1086 2y ago
The only thing I really disagree with in the article is that security needs are opposed to a good user experience. It is certainly true that security needs can sometimes get in the way of better UX although there is plenty of security that users never encounter. It is also true that the UX of many security designs is awful. However, it is not true to say that security requirements are opposed to good UX. You can absolutely create good UX with good security, but it will require more effort. Improving your UX doesn't normally hurt security. In fact, having better UX can help security. Conversely, improving your security does not inevitably hurt your UX (although it certainly can if you don't give it sufficient consideration).
- nox101 2y ago
  I think github is an example of those. 9 of 10 integrations just ask for blanket permissions. Effectively, "give us permissions to edit and make commits to all of your repos, and every other possible thing that's possible to do on github and in return we'll setup everything so our service works for you immediately" Vs, here's 10 to 20 steps you can follow to give us the minimum permissions to use our service with a single repo. Go manually make repo specific tokens with specific permissions (10 steps) then go paste those tokens into our service (4-5 steps), now go add these actions to your repo (4-5 steps) and set these settings in that repo (5-15 steps) So in this case, security is at odds with UX. IMO, this is github's fault. Instead of providing an API and UX that would let users specify specific repos and choose specific permissions per repo, they did the more obvious and technically simpler thing. But, unfortunately, the more obvious easier thing, means the path of least resistance for integrations to do is ask for all permissions. I would argue you could paint that as github has not made security their top priority. If they cared about security then the path of least resistance would lead to the most secure integrations instead of what they have now which leads to the least secure integrations.
  - MattPalmer1086 2y ago
    That's a great example of where the design space gets harder and requires more effort to do well, but not that security is inevitably at odds with UX. Just that it gets harder to design well. I think you're right about GitHub taking the most obvious route and prioritising UX over security. Managing permissions and getting to least privilege is a huge problem in security. If you rely on users to do it, they will pretty much always assign maximum perms. It's too much hassle to figure it all out, and maybe have something break later. Just spitballing, but maybe an alternate way would be for GitHub to require integrations to specify their least privilege permissions to operate in a manifest. Users would just approve an integration for whatever repos they like, and GitHub would set things up so it operated in least priv config for you in those repos. The user gets better security and a better UX. Maybe that wouldn't work for some reason, there are probably loads of things wrong with it. But my point is that further thought about the goals of the user (which includes having a secure system) could lead to a much better UX and better security.
Jiro 2y ago
Dilbert strip on "is our top priority": https://qhselife4business.typepad.com/qhse-life-for-business-bl/2011/12/about-priorities.html https://qhselife4business.typepad.com/qhse-life-for-business...
- teddyh 2y ago
  Better link: <https://dilbert-viewer.herokuapp.com/2004-03-28 https://dilbert-viewer.herokuapp.com/2004-03-28>
nox101 2y ago
Could you sue for false advertising?
throwaway81523 2y ago
They used to say employees were #1, then they switched to security being #1. In reality, security is #10. See: https://i.pinimg.com/originals/71/2c/a5/712ca583647508a50606bc66974dc2cf.gif https://i.pinimg.com/originals/71/2c/a5/712ca583647508a50606...
doctor_eval 2y ago
> The needs of security are opposed to the needs of a convenient user experience. Improving one typically hurts the other. I must be Dr Contrary tonight but this strikes me as bullshit. SSH is more convenient that telnet. Passkeys are more convenient than passwords. TouchID and FaceID are more convenient than passwords. In general, security is an afterthought that is inconvenient to developers to add back. But in the digital world I haven’t seen many examples of security being less convenient than the alternative. (I am writing this from an airport and definitely do not assert that this applies to the built environment.)
el_burner 2y ago
Even if it weren't meaningless, what's the last time you heard someone say that when it wasn't a blatant lie?
- AnimalMuppet 2y ago
  When Microsoft pivoted to security, they seemed to really mean it. They stopped shipping new features for something like 6 months, and spent the time hardening the OS. The results weren't perfect, but they made Windows not the total joke it had been.
another-dave 2y ago
> It sounds nice, but does this in practice mean that whenever anyone has an idea to improve security, at the expense of UX, consumer prices, etc, you still implement it? Because that is what it sounds like. Does it sound like this? If a restaurant says that "our food is our top priority", I don't think anyone would think that means they're not going to lease a premises, buy chairs/tables, hire waiters etc. To me, the very fact that you say something is your "_top_ priority" implies that you have other priorities. It feels like the author is responding instead to the premise "security is our only priority".
- jtwaleson 2y ago
  These companies do not sell security, they sell products that need to be secure. The restaurant sells food which needs to be safe. A more apt analogy would be a restaurant saying "food safety is our top priority". To me that sounds like a restaurant that wastes a lot of plastic and produces a lot of food waste that might spoil soon.
uhjk 2y ago
[flagged]

84 points by jtwaleson 2y ago

wkat4242 2y ago

I think it's even simpler than the article states. For every company, profit is the top priority.

jtwaleson 2y ago
Author here. I agree with what I think you mean, but stating it like that is too simplistic in my view. Money is a great way to measure effort and results, and it's top priority in that at the end of the line, without profit there is no company. But without people, products, a mission, and not being hacked too many times, there is also no company.
- asynchronous 2y ago
  Wanted to say I appreciated the GK Chesterton quote, I think it set up the article well as a balancing act between all things. As the saying goes, we could have perfect security if we lived in the Stone Age.
  - jtwaleson 2y ago
    Thank you. I hadn’t heard that one before but exactly right :)
danpalmer 2y ago
While this is correct, it's also not a particularly useful point. A company can't just do profit. Profits aren't a thing that a company can choose (typically), they aren't an input, they're an output. You can't choose your outputs, you can only choose your inputs and aim them towards specific outputs. How do you achieve profits? Well you do things that your customers want, and one of those things might be security. For some companies, the input of investment in security will result in the output of profits. For others it won't, or the two will be less correlated. If security does convert well into profits then it follows that it should be a priority input for the company, because that's how they will achieve profits. This is still a huge generalisation, but perhaps less of one than "profit is the top priority".
- Xen9 2y ago
  I feel skeptical; except abuse of worst nature; and do not care enough to comment coherently. A future lives around me. Yet what to Dan means a better model, distantly brings to mind the four conveyor belts from: https://archive.org/details/the-age-of-surveillance-capitalism/ https://archive.org/details/the-age-of-surveillance-capitali...
- GeneralMayhem 2y ago
  There's a big problem of information asymmetry, though. "Security" is a very noisy metric, and not a quality that's easily evaluated by 99.9% of your customers. Outside of specialty domains like national defense (and even then...) customers don't generally care about "secure", they care about "not obviously insecure", and almost all products will appear to be "secure" enough right up until the moment that they're visibly or publicly compromised. If you either stay under the radar or get lucky long enough, you can turn profits for quite a while before the chickens come home to roost.
- markus23 2y ago
  security (at least as meant in the advertisement) is also output
switch007 2y ago
The owners getting rich is the top priority
- draugadrotten 2y ago
  Indeed, a company is supposed to do what the owner of the company wants. A company does not have morals; owners do.This is why owners matter. You are starting to discover what is called a "business model". For a good introduction, take a look at Osterwalders BMC. https://www.strategyzer.com/business-models-the-toolkit-to-design-a-disruptive-company https://www.strategyzer.com/business-models-the-toolkit-to-d...

jtwaleson 2y ago

The title was edited here by mods (I liked the original, but "BS" is a maybe a bit clickbaity?). Could it be changed to: "Security is our top priority" is meaningless. ?

Springtime 2y ago

> In my ideal world, companies would say "We maintain a state of the art security system [...] it is one of the most important things we work on and we spend a large amount of our effort on it." Tbh as a consumer I'd rather a company not just give self-appraisals of security in the form of overt marketing lines but let pen tests, post-mortem analyses and such speak to their robustness/lessons they've learned. Marketing is virtually always that security is top notch regardless of realities so it's hard not to be skeptical of ordinary spiels. It's like third-party VPN services. It's all well and good to market security but when they get breached/raided/etc and it turns out they don't hold up to the claims then it just increases one's cynicism. At least those like Mullvad from everything I've seen match their statements (no affiliation, nor do I even use it, just useful for this example). Ed Catmull of Pixar once brought up in a talk, referring to cliched lines like "Story is the most important thing" despite various productions' output being mediocre in that regard, that once an important idea can be encapsulated into a concise statement that the statement per se can be used without fear of changing behavior. Could be said for a lot of marketing.

vaylian 2y ago
> but let pen tests, post-mortem analyses and such speak to their robustness/lessons they've learned. It depends on which audience you want to reach when you want to advertise how secure your product/service is. Most people outside IT security have no idea what a penetration test is nor can they make sense of jargon-heavy post-mortems.
- Springtime 2y ago
  They can put such things in a company blog for those who are looking for it, it doesn't have to be on the front page. Google, Cloudflare, the previously mentioned Mullvad, etc take this approach (and they often wind up submitted to the relevant audiences). This strengthens their brand trust in terms of security among key groups.
JohnFen 2y ago
I agree entirely. > I'd rather a company not just give self-appraisals of security Companies routinely lie right to your face. No company's self-appraisal about anything is worth paying any attention to.

jsemrau 2y ago

What I commonly see with "top priority" is that it means it's someone else's responsibility. Usually allocated to the CEO.

miika 2y ago

If security is top priority, to me it starts from deciding what kind of data actually needs to be stored. Then the service is designed from that perspective. More sensitive data I need store, more I need to think about security as well (and more expensive it gets). If it's obvious that the service doesn't have much worth of hacking for, it's already better starting point than if I know it's going to be hack attraction.

jjav 2y ago

Here's a true story about one instantiation of "security is our top priority". You be the judge on whether this is an extreme outlier or pretty much the norm. I was at one company where the PM blurted out (paraphrasing, but very close) "Enough of security talk. We will put out some nice wording on our website stating that security is our top priority and our product is perfectly secure. And that's that. We will not spend a single penny beyond that on making it so-called secure." So, that's often what companies mean when they say "security is our top priority". (The referred PM has since had a long career at a fruit-shaped FAANG, presumably making products secure. I hope they have grown up a bit.)

Dalewyn 2y ago
Looking at it another way, he put an end to further spending on "security talk" by putting up the security talk of security talks. Art of the Deal indeed.
lb1lf 2y ago
On a somewhat related note, I once worked on a vessel which had 'SAFETY FIRST' stencilled onto the superstructure (quite common). Underneath, someone had stencilled in slightly smaller script 'second only to profit' (Somewhat less common, but refreshingly honest. Or cynical. Or both)
- Dalewyn 2y ago
  Reminds me of this insightful article: https://mikerowe.com/2020/03/walk-me-through-this-safety-third-thing/ https://mikerowe.com/2020/03/walk-me-through-this-safety-thi...
- WalterBright 2y ago
  Safety is a luxury that profit enables. Increased productivity => increased profits => more safety Nothing comes for free.
  - worble 2y ago
    Or, more likely Increased productivity => increased profits => shareholders see number goes up => number must go more up year on year => everything (including safety) falls to the wayside in the pursuit of more profit

catoc 2y ago

The same as “We care about your privacy”

doe_eyes 2y ago
I actually think these are very different. Big tech companies generally care about security because most of the time, it aligns with their self-preservation. They don't want their secret sauce leaked, they don't want internal mails and payroll posted on the internet, they don't want their users hurt. It's not "top priority", but security probably shouldn't be your top priority; if it is, there is only one winning move: don't build anything. That said, security often ranks high, especially if the company had a couple of close calls before. In contrast, preserving privacy is often in direct contrast to business goals. You want to preserve it to some limited extent to maintain user trust and avoid offending the regulators, but there is a constant business pressure to get real close to that line.
- catoc 2y ago
  I actually think we're saying the same thing. Big tech companies care about profit. That's fine, they're companies. If security - or a pretense thereof - is needed to increase or safeguard profits, only at that point do they start 'caring' about security. With privacy it's even worse. Think Apple cares about privacy? It's just - currently - aligned with their product strategy.
parasti 2y ago
I always finish that sentence in my head with something like "we care about your privacy so much that we want to collect all your personally identifiable data and sell it".

konschubert 2y ago

"Safety Third" by Mike Rowe: https://www.youtube.com/watch?v=Km8XxRCuCho https://www.youtube.com/watch?v=Km8XxRCuCho (I don't fully agree with the message though. It's not just the user of the process that is responsible for their safety. It's mostly the designers of the process.)

whatnotests2 2y ago

Under capitalism, anything is lucky to come second, after profit.

Animats 2y ago

The military has a better model of security. They protect things at different security levels. I've spent time in the classified world. Security can be obtained, but costs are high. At the aerospace company, we estimated for bid purposes that running a project at SECRET doubled the cost. Running at levels above that became even more expensive, and much slower. You have to partition things, so that only the really critical stuff gets the most expensive protection. It's common to have a project where the project is mostly unclassified, many things are SECRET, and a very few things are at higher levels. The military views security as time-limited. When and where the attack will start is highly classified until the attack is underway. After that, there is no secret. New weapons systems eventually get used or cancelled, after which they're less secret. The intelligence community wants to protect info forever, though. The credit card services get this. The CVV is required to have a higher level of protection than credit card numbers or names and addresses. Banks understand separation of functions and mutual mistrust. Most computer security work doesn't think this way.

LilBytes 2y ago
Interesting that your experience was a double increase in costs from going up in security level. My experience was it was an order of magnitude (10x) at each level . E.g., OFFICIAL let's say is $1,000,000 PRIVATE becomes $10,000,000 SECRET becomes $100,000,000 What we did experience was the cost in time to deliver a service doubled however. E.g., OFFICIAL was 3 years, PRIVATE was 6 years and so on. I expect it varies significantly between types of system, ours was a SaaS platform that read telemetry from embedded systems on assets in the field, so I'd assume that would be one of the drivers for my differing experience than yours.
WalterBright 2y ago
> Most computer security work doesn't think this way. The computer industry is determined to relearn the well-known lessons the hard way. For example, we still have a single password breach brings down the entire system. It's like building a battleship that would sink if a 2 inch hole in the hull happened. The way to make systems secure is not to devise a perfect password system. The way is to make the system secure in spite of password breaches. It's a completely different mindset. To return to the battleship analogy, it isn't about preventing holes in the hull. It's about surviving holes in the hull.

cjpearson 2y ago

Instead of Chesterton, I think Thomas Aquinas made the same point more simply: "If the highest aim of a captain were to preserve his ship, he would keep it in port forever."

jtwaleson 2y ago
That’s beautiful and succinct. I wasn’t aware of it, thanks for sharing!
olivierduval 2y ago
When I started to work at a big company on car safety, my manager told me as a joke: "the safest car is the car that doesn't move".
Y_Y 2y ago
> A ship in port is safe. But that’s not what ships were built for. arsa Grace Hopper, who was quoting John Shedd.
spywaregorilla 2y ago
What if two other aims, combined, outweighed the desire for safety?

wofo 2y ago

> It takes guts to defend non-extremist positions, because the extremists will always have more powerful one-liners. Thanks for that quote :)

jtwaleson 2y ago
It’s a pretty powerful one-liner right? ;)

MattPalmer1086 2y ago

The only thing I really disagree with in the article is that security needs are opposed to a good user experience. It is certainly true that security needs can sometimes get in the way of better UX although there is plenty of security that users never encounter. It is also true that the UX of many security designs is awful. However, it is not true to say that security requirements are opposed to good UX. You can absolutely create good UX with good security, but it will require more effort. Improving your UX doesn't normally hurt security. In fact, having better UX can help security. Conversely, improving your security does not inevitably hurt your UX (although it certainly can if you don't give it sufficient consideration).

nox101 2y ago
I think github is an example of those. 9 of 10 integrations just ask for blanket permissions. Effectively, "give us permissions to edit and make commits to all of your repos, and every other possible thing that's possible to do on github and in return we'll setup everything so our service works for you immediately" Vs, here's 10 to 20 steps you can follow to give us the minimum permissions to use our service with a single repo. Go manually make repo specific tokens with specific permissions (10 steps) then go paste those tokens into our service (4-5 steps), now go add these actions to your repo (4-5 steps) and set these settings in that repo (5-15 steps) So in this case, security is at odds with UX. IMO, this is github's fault. Instead of providing an API and UX that would let users specify specific repos and choose specific permissions per repo, they did the more obvious and technically simpler thing. But, unfortunately, the more obvious easier thing, means the path of least resistance for integrations to do is ask for all permissions. I would argue you could paint that as github has not made security their top priority. If they cared about security then the path of least resistance would lead to the most secure integrations instead of what they have now which leads to the least secure integrations.
- MattPalmer1086 2y ago
  That's a great example of where the design space gets harder and requires more effort to do well, but not that security is inevitably at odds with UX. Just that it gets harder to design well. I think you're right about GitHub taking the most obvious route and prioritising UX over security. Managing permissions and getting to least privilege is a huge problem in security. If you rely on users to do it, they will pretty much always assign maximum perms. It's too much hassle to figure it all out, and maybe have something break later. Just spitballing, but maybe an alternate way would be for GitHub to require integrations to specify their least privilege permissions to operate in a manifest. Users would just approve an integration for whatever repos they like, and GitHub would set things up so it operated in least priv config for you in those repos. The user gets better security and a better UX. Maybe that wouldn't work for some reason, there are probably loads of things wrong with it. But my point is that further thought about the goals of the user (which includes having a secure system) could lead to a much better UX and better security.

Jiro 2y ago

Dilbert strip on "is our top priority": https://qhselife4business.typepad.com/qhse-life-for-business-bl/2011/12/about-priorities.html https://qhselife4business.typepad.com/qhse-life-for-business...

teddyh 2y ago
Better link: <https://dilbert-viewer.herokuapp.com/2004-03-28 https://dilbert-viewer.herokuapp.com/2004-03-28>

nox101 2y ago

Could you sue for false advertising?

throwaway81523 2y ago

They used to say employees were #1, then they switched to security being #1. In reality, security is #10. See: https://i.pinimg.com/originals/71/2c/a5/712ca583647508a50606bc66974dc2cf.gif https://i.pinimg.com/originals/71/2c/a5/712ca583647508a50606...

doctor_eval 2y ago

> The needs of security are opposed to the needs of a convenient user experience. Improving one typically hurts the other. I must be Dr Contrary tonight but this strikes me as bullshit. SSH is more convenient that telnet. Passkeys are more convenient than passwords. TouchID and FaceID are more convenient than passwords. In general, security is an afterthought that is inconvenient to developers to add back. But in the digital world I haven’t seen many examples of security being less convenient than the alternative. (I am writing this from an airport and definitely do not assert that this applies to the built environment.)

el_burner 2y ago

Even if it weren't meaningless, what's the last time you heard someone say that when it wasn't a blatant lie?

AnimalMuppet 2y ago
When Microsoft pivoted to security, they seemed to really mean it. They stopped shipping new features for something like 6 months, and spent the time hardening the OS. The results weren't perfect, but they made Windows not the total joke it had been.

another-dave 2y ago

> It sounds nice, but does this in practice mean that whenever anyone has an idea to improve security, at the expense of UX, consumer prices, etc, you still implement it? Because that is what it sounds like. Does it sound like this? If a restaurant says that "our food is our top priority", I don't think anyone would think that means they're not going to lease a premises, buy chairs/tables, hire waiters etc. To me, the very fact that you say something is your "_top_ priority" implies that you have other priorities. It feels like the author is responding instead to the premise "security is our only priority".

jtwaleson 2y ago
These companies do not sell security, they sell products that need to be secure. The restaurant sells food which needs to be safe. A more apt analogy would be a restaurant saying "food safety is our top priority". To me that sounds like a restaurant that wastes a lot of plastic and produces a lot of food waste that might spoil soon.

uhjk 2y ago

[flagged]